{
	"id": "59bf3af0-e0ae-404d-8ee0-5879f7d99615",
	"created_at": "2026-04-06T00:13:41.658957Z",
	"updated_at": "2026-04-10T03:20:07.177595Z",
	"deleted_at": null,
	"sha1_hash": "38f66a3331eaecc24c326aed951004c7f135a69d",
	"title": "Digital Forensics Show S.A.R. Geelani’s Phone Was Hacked, Likely With Zero-Click Exploit - The Wire",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 422476,
	"plain_text": "Digital Forensics Show S.A.R. Geelani’s Phone Was Hacked, Likely\r\nWith Zero-Click Exploit - The Wire\r\nBy Sukanya Shantha\r\nPublished: 2021-07-18 · Archived: 2026-04-05 17:24:21 UTC\r\nMumbai: Sometime in mid-2017, former Delhi University professor Syed Abdul Rahman Geelani received a\r\nbarrage of SMSes on his mobile phone. “United Nations launches online portal for the independence of Kashmir,”\r\nread one.\r\nAnother message, a few days later, claimed: “Another incident showing Indian army beating librandu Kashmiri\r\nyouth mercilessly to chant Pakistan Murdabad.”\r\nThere were several more – all unique, tailor-made messages, specifically designed to capture Geelani’s attention –\r\nsent from what looked like an international number.\r\nGeelani’s number, selected as a target for hacking by an government client of Israel’s NSO Group, was infected\r\nbetween 2017 and 2019, according to the results of an independent digital forensics study conducted on his phone\r\nin the last month.\r\nAmnesty International’s Security Lab carried out a forensic analysis of Geelani’s phone, an iPhone still preserved\r\nby his family, the results of which the organsation say confirm that the phone was compromised on and off for\r\nover two years.\r\nGeelani’s phone was infected with Pegasus spyware – the Tel Aviv-based firm’s flagship product, which allows\r\noperators of the tool to gain unauthorised access to a user’s mobile device and functions.\r\nhttps://thewire.in/rights/sar-geelani-pegasus-spyware-phone-messages\r\nPage 1 of 4\n\nIt’s unclear if the SMS-based attacks worked, but specific forensic analysis conducted by Amnesty International’s\r\nSecurity Lab show that the phone was compromised by Pegasus on and off between February 2018 and January\r\n2019, and then again from September 2019 to October 2019. At least one of these attacks, Amnesty notes, was\r\ncarried out through a zero-click iMessage exploit.\r\nAlso read: FAQ: On the Pegasus Project’s Digital Forensics\r\nThe France-based media non-profit, Forbidden Stories, and Amnesty International’s Security Lab gained access to\r\nthese records, which they shared with The Wire and 15 other news organisations worldwide as part of a\r\ncollaborative investigation and reporting project.\r\nGeelani, who used to teach Arabic at Delhi University’s Zakir Hussain College, was arrested in connection with\r\nthe parliament attack case but was later acquitted for “want of evidence” by the Delhi high court in October 2003,\r\na decision later upheld by the Supreme Court in August 2005.\r\nGeelani, who had garnered massive support at the time of his incarceration, dedicated his life to working for those\r\njailed, especially for their political views. He, along with his friend Rona Wilson – named as a prime accused in\r\nthe 2018 Elgar Parishad case – founded the Committee for Release of Political Prisoners (CRPP). Associated with\r\nseveral causes relating to human rights violations across the country, Geelani later became a core part of the 17-\r\nmember Committee for Defence and Release of G.N. Saibaba.\r\nSaibaba, a Delhi University professor, was sentenced to life under several sections of the Unlawful Activities\r\n(Prevention) Act (UAPA) for his alleged links with a banned Maoist organisation. With over 90% physical\r\ndisability, Saibaba has faced severe hardships in jail but been denied bail multiple times both by the lower and\r\nhigher judiciary.\r\nAlso read: Old RTI Response Enough To Deny Govt-Pegasus Link, Media Didn’t Do Due Diligence: MeitY\r\nGeelani’s son Sayed Atif Geelani, a Delhi-based lawyer, who had preserved the phone even after his father’s death\r\nin October 2019, told The Wire that the forensic report has only confirmed the fears they had lived under for\r\ndecades. “We have always feared that the family is being tracked. For months after his (Geelani’s) death, his\r\nphone would notify us about attempts made to hack into his email and phone. This forensic result has only\r\nconfirmed our suspicion,” Atif said.\r\nhttps://thewire.in/rights/sar-geelani-pegasus-spyware-phone-messages\r\nPage 2 of 4\n\nScreenshots of malware-laden messages sent to S.A.R. Geelani’s iPhone. He was one of the initial victims of the\r\nPegasus attack.\r\nBesides Geelani, the leaked data has also thrown up the numbers of nine more members and close supporters of\r\nthe Saibaba Defence Committee.\r\nWilson and his co-accused in the Elgar Parishad case and an associate professor from Delhi University, Hany\r\nBabu, were also on the list. Hany Babu was also a core team member of both CRPP and the Saibaba Defence\r\nCommittee; he mainly handled the press releases and his email ID and phone numbers were usually printed on the\r\npress statements.\r\nOther members or close supporters of the Saibaba Defence Committee and CRPP to be selected as potential\r\ntargets were retired professor G. Haragopal, chairman of the Defence Committee, Saroj Giri and Rakesh Ranjan,\r\nboth assistant professors in Delhi University who would regularly attend solidarity meetings, Saibaba’s wife\r\nVasantha Kumari and two other academics who did not wish to be named from Delhi.\r\nTo be clear, it is not possible to know whether the phones of Babu, Wilson and other members of the committee\r\nsaw attempted targeting or were compromised by an infection without digital forensic analysis.\r\nThe Wire had arranged for a forensic analysis of Haragopal’s Android phone devices. However, the results were\r\ninconclusive because unlike iPhones, Androids do not log the kind of information needed for Amnesty’s technical\r\ninvestigation.\r\nWhile the Saibaba Defence Committee is a separate entity, many associated with it have been questioned by the\r\nNational Investigating Agency in the Elgar Parishad case too. Atif told The Wire that the family had feared\r\nGeelani’s arrest in the Elgar Parishad case. “If my father hadn’t died in October, we are pretty certain that they\r\nwould have found a way to implicate him too in the case,” claimed Atif.\r\nAlso read: Read: NSO Group’s Response to the Pegasus Project and Our Take\r\nVasantha said the period of surveillance overlaps with many significant meetings and protests organised across\r\nIndia demanding Saibaba’s release. “Soon after Saibaba’s conviction, the Defence Committee had organised\r\nhttps://thewire.in/rights/sar-geelani-pegasus-spyware-phone-messages\r\nPage 3 of 4\n\nseveral meetings across different cities. The activities were all in the public domain, with press statements\r\npublished regularly on different social media platforms,” she said.\r\nVasantha was not surprised that she was also one of the potential targets of Pegasus. “I have been facing threats\r\nand intimidation ever since Saibaba was falsely charged in 2014 and I began participating in public meetings and\r\nspeaking against his false arrest and later his conviction. This is an extension of the targeted harassment I have\r\nbeen enduring over the past decade,” she added.\r\nHany Babu’s wife Jenny Rowena, also an associate professor at DU’s Miranda College, feels that her husband\r\ncame to be targeted because of his identity. “He is a Muslim man, an OBC (Other Backward Classes) and spoke\r\nagainst the state machinery for criminalising people from similar marginalised identities.”\r\nAn Appeal: Support Investigative Journalism That Brings You The Truth. Support The Wire.\r\nRanjan and Giri told to The Wire that although they weren’t office-bearers of the committee, they would\r\nparticipate in meetings regularly. “Saibaba’s arrest and conviction was widely opposed. Like most others, I too\r\nwould participate in those meetings regularly,” Ranjan confirmed.\r\nGiri said his long association with both Saibaba and Wilson may have made him a target. “I have been an integral\r\nto the committee which has been demanding his release. In the last few years, I have tried to mobilise support for\r\nthe incarcerated DU professor G.N. Saibaba,” he told The Wire. When Saibaba’s house was raided twice before his\r\narrest his 2014, Giri was by his side, defending and mobilising people against the arrest. Later when Saibaba was\r\nout on bail, Giri says, he would take him to the hospital many times. “His condition was critical then. I would\r\ntravel with him to hospitals regularly.”\r\nRead The Wire’s coverage as part of the Pegasus Project here.\r\nSource: https://thewire.in/rights/sar-geelani-pegasus-spyware-phone-messages\r\nhttps://thewire.in/rights/sar-geelani-pegasus-spyware-phone-messages\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://thewire.in/rights/sar-geelani-pegasus-spyware-phone-messages"
	],
	"report_names": [
		"sar-geelani-pegasus-spyware-phone-messages"
	],
	"threat_actors": [],
	"ts_created_at": 1775434421,
	"ts_updated_at": 1775791207,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/38f66a3331eaecc24c326aed951004c7f135a69d.pdf",
		"text": "https://archive.orkl.eu/38f66a3331eaecc24c326aed951004c7f135a69d.txt",
		"img": "https://archive.orkl.eu/38f66a3331eaecc24c326aed951004c7f135a69d.jpg"
	}
}